WPMU DEV

Mentions · 7d0
Mentions · 30d0
All mentions3
First seenAug 17, 2026
Last mentionedAug 29, 2026

Timeline

3 articles · newest first

Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

Five critical flaws (CVSS 9.8–10.0) in WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP enable WordPress admin takeover and RCE.

The Hacker NewsAug 29, 16:25 UTC · Aug 29, 2026VulnerabilityCVE-2026-76581 CVE-2026-18431 CVE-2026-19632+21

Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin

Wordfence researchers disclosed a critical unauthenticated authentication bypass in the WPMU DEV Dashboard plugin, enabling admin takeover and possible RCE.

WordfenceAug 27, 17:41 UTC · Aug 27, 2026Vulnerability1 · 1 read

Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

Wordfence disclosed CVE-2026-15748, a critical unauthenticated file upload flaw enabling RCE in the Forminator Forms WordPress plugin, patched in version 1.56.2.

The Hacker NewsAug 17, 18:22 UTC · Aug 17, 2026VulnerabilityCVE-2026-15748 CVE-2026-158261 · 1 read

Related CVEs

by mentions

CVE-2026-822222%10.0
Unauthenticated PHP Object Injection Leading to RCE in GiveWP WordPress Plugin
published Aug 28, 2026Liquid Web / StellarWP GiveWP (WordPress plugin)PoC
CVE-2026-195983%9.8
Unauthenticated Privilege Escalation in WordPress Pods Plugin Enables Site Takeover
published Aug 15, 2026Pods Foundation Pods – Custom Content Types and Fields (WordPress plugin)
CVE-2026-157484%9.8
Unauthenticated RCE via Arbitrary File Upload in Forminator Forms WordPress Plugin
published Aug 18, 2026WPMU DEV Forminator Forms (WordPress plugin)PoC
CVE-2026-76581<1%9.8
Unauthenticated Admin Authentication Bypass in WPMU DEV Dashboard 5.0.1 and earlier
published Aug 28, 2026WPMU DEV Dashboard (WordPress plugin)
CVE-2026-19632<1%9.8
Unauthenticated Sensitive Information Exposure in TranslatePress WordPress Plugin
published Aug 26, 2026TranslatePress – Translate Multilingual sites with AI Translation (WordPress plugin)
CVE-2026-18431<1%9.8
Unauthenticated Arbitrary File Write to RCE in Avada WordPress Theme
published Aug 26, 2026ThemeFusion Avada theme for WordPress
CVE-2026-158264%9.8
Unauthenticated Admin Login Bypass in WordPress User Profile Builder Plugin (≤3.16.4)
published Aug 15, 2026Cozmoslabs User Profile Builder (Profile Builder) plugin for WordPress

Appears with

Wordfencevendor · 3
WordPressvendor · 2
WPMU DEV Dashboardproduct · 2
User Profile Builderproduct · 1
Forminator Formsproduct · 1
GiveWPproduct · 1
TranslatePressproduct · 1
WordPressproduct · 1
Avadaproduct · 1
Podsproduct · 1
Patchstackvendor · 1
Fusion Builderproduct · 1

Entities are extracted by the model from each article. First seen Aug 17, 2026, last mentioned Aug 29, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.